Executive brief
Grav is a flat-file content management system used to build and manage websites. A vulnerability in Grav's Flex framework allows authenticated users with basic create or update permissions to execute arbitrary shell commands on the server by exploiting unvalidated function calls in blueprint directives. This enables complete server compromise, including data theft and website defacement.
Technical details
The vulnerability exists in FlexDirectory::dynamicDataField(), which processes blueprint data-*@: directives by calling call_user_func_array() on attacker-influenced input. The method validates only that the target is callable using is_callable(), without restricting dangerous functions like exec(), system(), passthru(), or shell_exec(). This bypasses a prior fix (GHSA-fj2p-qj2f-74v5) applied to Blueprint::dynamicData() in version 2.0.7, because FlexDirectory registers a separate handler that was left unpatched. Any authenticated user with create or update permission on Flex-based directories (Flex Users, Flex Pages, Flex Objects, or custom Flex types) can exploit this by crafting malicious blueprint field data. The attack vector is network-based and requires only basic authenticated user privileges. Patches are available in version 2.0.9 and later.
Affected products
- Grav Grav >= 1.7.0, < 2.0.9
Timeline
- 2026-07-23: disclosed
- 2026: patched: patched in version 2.0.9
- 2026-09-17: other: duplicate advisory withdrawn, refers to GHSA-c4wf-2xxc-68qm